The popular video meeting app makes it easy to keep the software up to date—but it also introduced vulnerabilities.
have been there: You fire up the Zoom app as you rush to join a meeting you’re already late for, and you’re hit with a prompt to download updates. If something like this has happened to you, you’re enrolled in Zoom's automatic update feature.in its current form in November 2021 for Zoom’s Windows and Mac desktop apps, the feature aims to help users keep up with software patches.
At the DefCon security conference in Las Vegas today, Wardle presented two vulnerabilities he found in the automatic update feature’s validation checks for the updates. For an attacker who already had access to a target Mac, the vulnerabilities could have been chained and exploited to grant the attacker total control of a victim’s machine.
“I was curious about exactly how they were setting this up. And when I took a look, it seemed on first pass that they were doing things securely—they had the right ideas,” Wardle told WIRED ahead of his talk. “But when I looked closer, the quality of the code was more suspect, and it appeared that no one was auditing it deeply enough.”
To automatically install updates after the user enters their password once, Zoom installs a standard macOS helper tool that Wardle says is widely used in development. The company set up the mechanism so only the Zoom application could talk to the helper. This way, no one else could connect and mess with things.
The first vulnerability Wardle found, though, was in the cryptographic signature check. Wardle knew from past research and his own software development that it can be difficult to truly validate signatures in the types of conditions Zoom had set up. Ultimately, he realized that Zoom’s check could be defeated. Imagine that you carefully sign a legal document and then put the piece of paper facedown on a table next to a birthday card that you signed more casually for your sister.
Indonesia Berita Terbaru, Indonesia Berita utama
Similar News:Anda juga dapat membaca berita serupa dengan ini yang kami kumpulkan dari sumber berita lain.
Refreshed 2023 Subaru Ascent priced at just over $35,0002023 Subaru Ascent three-row SUV gets updated styling and new standard features. Pricing starts just over $35,000.
Baca lebih lajut »
Pixel's At a Glance is getting back a very useful feature that was lost to the pandemicPixel's At a Glance widget is getting back an old friend that the pandemic took away. The Commute feature is coming back.
Baca lebih lajut »
What the Tech? Is the Ability to Undo Text Messages Dangerous? - Alabama NewsA new feature most iPhone users have asked for is coming this fall, but it may cause serious problems for people going through child custody issues. whatthetech iphone ios16 alabamanewsnetwork
Baca lebih lajut »
Big Mac is coming back: McDonald’s to reopen in UkraineMcDonald's will start reopening restaurants in Ukraine in the coming months, a symbol of the war-torn country's return to some sense of normalcy and a show of support after the American fast-food chain pulled out of Russia.
Baca lebih lajut »
Big Mac is coming back: McDonald’s to reopen in UkraineMcDonald’s said Thursday that it will begin gradually reopening some restaurants in the capital, Kyiv, and western Ukraine.
Baca lebih lajut »
BMW partners with Toyota on fuel cell vehicles, will build a few this year | AutoblogBMW and Toyota have long worked together on vehicle development, so it's not surprising to hear that the two auto giants are coming together for hydrogen fuel cell vehicles.
Baca lebih lajut »